One vendor quoted a vulnerability scan, the other a penetration test. What's the difference and which do we need?

Think of it like this: a vulnerability scan is a robot scanning the exterior of a building with binoculars to see if any windows appear open. Half the time, a glare looks like an open window. A pen test is a skilled locksmith actively trying to pick the lock and break inside. Enterprise clients always want the locksmith's report.

We made the exact same mistake two years ago. We sent a $1,200 automated scan report to close a $50k deal. Their CISO rejected it in 10 minutes flat, saying "This isn't a pentest, it's a standard scanner export," and froze the deal for two months. We ended up having to shell out $6,000 for a real test anyway.

Check the exact wording on the client's security questionnaire. If it asks for a "penetration test report performed by an independent third party," drop the $1,500 quote right away. Handing them a vulnerability scan is just gonna waste everyone's time.

The firm charging $1,500 is probably just running an open-source scanner against your infrastructure and slapping their logo on the PDF export. You could run that yourself in two hours, definitely don't pay for it.

Third-party vendor risk assessments in the enterprise space follow rigid compliance guidelines. Because your HR platform handles employee personal data, legal and compliance teams will only accept the executive summary and remediation sign-off that comes from a manual penetration test as valid audit evidence.

negotiate with the 6,500 dollar company, they'll drop it to around 5,500 and but definitely go with the penetration test, the other one looks super amateur in frnot of the client.

Edit: asked below, I wrote the answer in the second message.

When negotiating with the second company, make sure to get a re-test clause included in the contract. Once the testing is done, they'll hand you a list of vulnerabilities, you'll patch them, and then you'll get a clean final report. That clean report is the actual document you need to present to the client.

I disagree with you on this point. The harder it is to reverse a decision, the slower you should make it.

Just leaving this note, it might be useful.

i agree.

I partly agree, partly disagree. The harder it is to reverse a decision, the slower you should make it.

Of course, it varies if your situation is different.

I have no experience with vulnerability scan penetration test, so I'm asking. Everyone rushing into vulnerability scan penetration test gets stuck at the same point.

If I were you, I'd go this route.

This approach has a cost, which isn't discussed. If 2FA is on, a stolen password alone is useless.

Taking notes for two weeks yields better results than a six-month estimate.

Could you elaborate on that? The real issue isn't the number, but what it's based on.

Taking measures without an inventory leaves doors you haven't seen open. Correct me if I'm wrong.

I think it's hard to be that definitive about vulnerability scan penetration test. tbh when we decide without measuring we always end up in the same place.

Solutions that work at a small scale collapse when you grow; I learned this late. tbh if I were you I'd go this route.

Thanks, that was the answer I was looking for. Your time to detect an issue directly determines its cost.

That's all, sorry if I went on too long.

Thanks for posting.

I'm a small business, let me explain from my side. Having backups accessible on the same network and with the same identity makes them part of the target.

Good luck with that.

I agree.